Simple Apex Controller with CRUD and FLS

apex-crud-fls.txt

This simple controller (without CRUD and FLS) ...

public with sharing class AccountController {

    @AuraEnabled
    public static List<Account> findAll() {
        return [SELECT id, name, Location__Latitude__s, Location__Longitude__s
            FROM Account
            WHERE Location__Latitude__s != NULL AND Location__Longitude__s != NULL
            LIMIT 50];
    }

}

... should be rewritten like this (With CRUD and FLS):

public with sharing class AccountController {

    @AuraEnabled
    public static List<Account> getAccounts() {

        String [] fields = new String [] {
            'Id',
            ’Name',
            ’Location__Latitude__s',
            ’Location__Longitude__s'
        };

        Map<String,Schema.SObjectField> m = Schema.SObjectType.Account.fields.getMap();

        for (String field : fields) {

            // Check if user has permission to view field
            if (!m.get(field).getDescribe().isAccessible()) {
                throw new System.NoAccessException()
                return null;
            }
        }

        return [SELECT id, name, Location__Latitude__s, Location__Longitude__s
            FROM Account
            WHERE Location__Latitude__s != NULL AND Location__Longitude__s != NULL
            LIMIT 50];

     }

}

Jeff, Should we also not check Schema.SObjectType.Account.isAccessible() either on line 28 or 39?

+1

If the field is accessible, so is the object.

Hi, line 36 launches an unreachable statement (return after throwing exception). Shouldn't that be out?

is that still necessary as we now have SECURITY_ENFORCED ?